services / Azure / Azure Firewall

Azure Firewall is a managed, stateful network firewall appliance that filters and inspects traffic for a virtual network, enforcing network/application/NAT rule collections and threat intelligence.

Acts as a network-perimeter defense for a single organizational function; its configuration reveals defensive posture and it can record in-transit traffic.

Microsoft.​Network/​azureFirewalls/​packetCaptureOperation/​action

Same firewall packet-capture capability under an alternate operation name: records live traffic flowing through the firewall, enabling exfiltration of sensitive in-transit data.

Risks

1. Data exfiltration (CRITICAL)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links